[Standards] Re: XEP-0440 and tls-server-end-point

tor 2024-01-11 klockan 13:39 +0100 skrev Holger Weiß: Indeed -- however I think the burden to support those kind of environments should be on the entities chosing to deploy and use those kind of environments, instead of placing the burden (and weakening security) for everyone else. While I think it is acceptable for standards to acknowledge and allow insecure usage modes (with proper caveats), I believe the primary purpose and default recommendations for a standard should be to promote secure behaviour. That is not achieved in XEP-0440 now. A compromise would be to mandate both tls-exporter and tls-server-end- point, however I'm hoping the short period that tls-server-end-point has been mandated can be ignored and we can select a better mandatory method. /Simon